Add actionable version mismatch alerts and watcher management

[Joxx0r]

Summary

• Compare git commit timestamps (not just hashes) between service and watcher to show "Service is outdated" or "Watcher is outdated" with the correct action button (rebuild & restart service vs restart watcher)
• Bake BUILD_GIT_TIMESTAMP into Docker images alongside the existing git hash, with fallback to .git-timestamp file
• Add ability to stop individual watchers when multiple are connected (shows each watcher with ID, start time, file count)
• Add "Restart Watcher" button in the dashboard Watcher Status card
• Stop watchers before workspace deletion to prevent zombie watchers that keep reconnecting
• Auto-start watcher after container start in the setup wizard
• Show per-project scan progress (phase, discovered/processed files) in setup workspace cards

Files changed

• Dockerfile — bake .git-timestamp alongside .git-hash
• src/service/api.js — add SERVICE_GIT_TIMESTAMP, include in /health and /watcher-status responses
• src/watcher/watcher-client.js — add watcherGitTimestamp and scanProgress tracking, include in heartbeat
• src/setup-gui.js — pass BUILD_GIT_TIMESTAMP build-arg, forward watcherId in stop requests
• public/index.html — timestamp comparison UI, overviewRebuildAndRestart(), stopSpecificWatcher(), restart button
• public/setup.html — stop watcher on workspace delete, auto-start watcher after container start, watcher progress polling

Test plan

• Rebuild Docker image + restart container → no mismatch alert
• Make a new commit, restart watcher only → alert says "Service is outdated" with "Rebuild & Restart Service" button
• Rebuild Docker + restart container (watcher still old) → alert says "Watcher is outdated" with "Restart Watcher" button
• Start two watchers → dashboard shows both with individual Stop buttons
• Delete a workspace → verify watcher stops before deletion (no zombie)
• Run setup wizard → watcher auto-starts after container start

🤖 Generated with Claude Code

[claude]

Good feature overall. The directional alerts and per-watcher stop buttons are solid UX improvements. A few issues to address before merging:

1. wmic deprecated on Windows 11 24H2+

start.bat uses wmic to terminate old processes, and killWatcherProcesses() in setup-gui.js uses it for the Windows orphan process scan. wmic was deprecated in Windows 10 and removed in Windows 11 24H2 (released Oct 2024).

The try/catch in killWatcherProcesses degrades gracefully (falls through to PID tracking + heartbeat), but start.bat is silent on failure — old processes simply are not killed. Replace with PowerShell equivalents.

For start.bat, replace the two wmic lines with:

powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $.CommandLine -like 'setup-gui.js' -or $.CommandLine -like 'watcher-client.js' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"

For the Windows branch in killWatcherProcesses, replace the wmic CSV command with a PowerShell equivalent that outputs CommandLine + PID pairs.

2. No tests for new complex logic

The multi-strategy watcher kill (tracked PID -> OS scan -> heartbeat), stopSpecificWatcher() polling, and the timestamp comparison direction logic are all untested. A unit test covering the kill-strategy selection in setup-gui.js would catch regressions without requiring integration setup.

3. loadWorkspaces monkey-patch is fragile (setup.html)

const _origLoadWorkspaces = loadWorkspaces;
loadWorkspaces = async function() {
await _origLoadWorkspaces();
stopWatcherPolling();
startWatcherPolling();
};

This breaks silently if anything else re-assigns loadWorkspaces. Better to call stopWatcherPolling()/startWatcherPolling() at the explicit callsites of loadWorkspaces instead of wrapping it.

4. Dual-context escaping in onclick (minor / low risk)

onclick="stopSpecificWatcher('${esc(id)}', this)"

esc() applies HTML entity escaping but the value is also a JS string literal. A watcherId containing a single quote or backslash produces broken JS — esc() does not apply JS-string escaping. Since watcherId is server-generated this is unlikely to trigger in practice, but using a data attribute + addEventListener avoids the dual-escaping problem entirely.